topic Re: Re: Re: * Another Section Access Question * in QlikView

* Another Section Access Question *

IAMDV — Mon, 10 Feb 2014 17:43:31 GMT

Hi Guys,

I hope one of you can help! I've searched on community but I couldn't find anything relevant.

I have two documents.

1: Master.QVW with Section Access

LOAD * INLINE [
    MYFIELD
    1
    2
    3
];

Section Access;
LOAD * INLINE [
    ACCESS, USERID, PASSWORD, MYFIELD
    ADMIN, ADMIN, ADMIN,
    USER, TEST, TEST, 1
];
Section Application;
When I open MASTER.QVW with "Initial Data Reduction with Section Access" everything works as expected. I.E. TEST user can only see 1 value and ADMIN no can see everything! No surprises so far

2: APP.QVW with/without Section Access

I'm using binary load in APP.QVW which is referring to Master.QVW . When I reload APP.QVW; I can see the USERID & PASSWORD prompt and when I enter the prompt with TEST & TEST respectively then I see all the data from MYFIELD instead of 1 row.

Either I'm not thinking right here or this must be bug because anyone can perform binary reload and get all the data!!! I'm well aware of "Prohibit Binary Load" option but that's not what I'm looking for... instead I wanted to see "1" value for MYFIELD in APP.QVW.

Please let me know if this doesn't make sense!

Thanks in advance.

Cheers,

Re: * Another Section Access Question *

hic — Mon, 10 Feb 2014 17:50:51 GMT

There are several situations where being "ADMIN" overrules the data reduction rules. This might be one... The idea is that ADMIN should be exactly that - an ADMIN - with no restrictions.

Try to do the same thing with USER access.

HIC

Re: * Another Section Access Question *

luis_pimentel — Mon, 10 Feb 2014 17:52:03 GMT

Hi Deepak

If you are ADMIN, you can overwrite the section access after a binary laod. The rule is : qvw inherit section access from the binary load but if you build a new section access in the calling qvw this will override rights defined in the binary, that's why you have the option "prohibit binary load" in order to avoid a user to do a binary and rewrite the Section Access.

So yes, you are right, anyone can perform binary reload and get all the data.

Cheers,

Luis.

Re: Re: * Another Section Access Question *

IAMDV — Mon, 10 Feb 2014 18:06:05 GMT

Luis - Thanks for quick response. I can't believe it but I guess I have to believe it! So anyone can perform binary reload and extract all the data irrespective of SA. I understand that SA is applied after the reload but I'd expect it to return only reduced data set.

HIC - Thank you for your time. I'm trying to extract the data of "USER" access and in the above example it's "TEST". So it shouldn't return all the data and in fact it worries me that anyone who has basic access to MASTER doc and Desktop client can see all the data. Unless we assume that all the Desktop client users are "ADMINS".

May be I'm over reacting but I'm worried about this issue!!

Re: * Another Section Access Question *

Luis_Cortizo — Mon, 10 Feb 2014 18:09:59 GMT

Have you checked the "Initial data reduction based on section access" check on the second document?.

Even if the binary load inherits the section access from the first document, if you don't check it no reduction will be performed.

I've just loaded your example tables in two QlikView documents and it works just find. The second document inherit the section access from the first one, ask for user and password and reduces the data.

However, if I don't activate the reduction check it asks for user and password but don't reduce anything.

Re: Re: * Another Section Access Question *

IAMDV — Mon, 10 Feb 2014 18:15:34 GMT

That's interesting! Do you mind posting both the Apps. I'm using "Initial data reduction based on section access" on the second document. I thought about it and expecting the data to reduce. But I'm not implementing SA on the Second document.

Thanks for your help,

Cheers,

Re: * Another Section Access Question *

Luis_Cortizo — Mon, 10 Feb 2014 18:15:41 GMT

"anyone who has basic access to MASTER doc and Desktop client can see all the data. Unless we assume that all the Desktop client users are "ADMINS""

No over reacting at all, but for me it makes sense.

The second document is performing a binary load from the first one and the person who is reloading is allowed to pass throught the section access (as they have a user and a password), but as the second QlikView document is not configured to perform a data reduction on opening it doesn't (even when the section access get inherited).

For me it's the same scenario as if anyone develops a really secure and complex section access but don't check the reduction option On Opening.

Re: Re: Re: * Another Section Access Question *

Luis_Cortizo — Mon, 10 Feb 2014 18:24:22 GMT

Sure!

Please find them attached.

P.S.: Test_SA is the document in which I loaded the example Section Access and BinaryTest_SA the one in which I performed a Binary Load of the Test_SA one.

Re: Re: * Another Section Access Question *

IAMDV — Mon, 10 Feb 2014 18:24:57 GMT

"For me it's the same scenario as if anyone develops a really secure and complex section access but don't check the reduction option On Opening."

I agree Luis! and I've seen loads of Developers not checking this box because it will restrict when you have conflicting access levels. However, I'd think whoever don't check this box as either "Lazy Developer" or "Novice Developer". My point is that you have the option to restrict the data. But in my example I either want an option or have a pessimistic approach by reducing the data instead of showing full data! After all, we are talking about application security and I'd expect to minimal access wherever possible.

Do you mind posting your example where you think it works (data reduction works on second document)?

I can see the attachment... please ignore the above message.

Thanks again.

Still

Re: Re: Re: * Another Section Access Question *

Luis_Cortizo — Mon, 10 Feb 2014 18:30:54 GMT

"After all, we are talking about application security and I'd expect to minimal access wherever possible."

Yes, I agree absolutely. As I totally agree on the need for security I wouldn't let the user to perform a binary load freely of sensible data anyway.

Take into account that the reduction is performed when you open the QlikView document. So right after the reload you will be able to see everything. If you save the document when you open it again it will ask for UserID and Password and then it will reduce the data (if anyone has activated the check).

Maybe is it an option to distribute to the people whom are going to perform the binary load an empty copy of a QlikView document with the option already checked?.

Re: Re: Re: * Another Section Access Question *

Anonymous — Mon, 10 Feb 2014 18:31:17 GMT

I think it is not much different from the situation when user with restricted access is allowed to reload. Reload brings all the data in this case. Data is restricted only if the user close/reopen.

Here the initial application is saved with all data. The fact that the user is "restricted" doesn't make any difference - reload overrides it.

Regards,

Michael

Re: Re: Re: * Another Section Access Question *

Luis_Cortizo — Mon, 10 Feb 2014 18:32:20 GMT

Yep, I agree.

Re: Re: Re: Re: * Another Section Access Question *

IAMDV — Mon, 10 Feb 2014 18:34:23 GMT

Hi Luis - Thanks for mocking up quick example. It's fine when I open BinaryTest_SA.QVW but when I reload the document then I'd see all the data. That's what seriously concerns me but I guess I have to live with this one. So it's really important to have check the "Prohibit Binary Load" setting on sensitive applications.

Update:

Totally agreed guys! I have nothing more to say rather than walking on a tight rope. Many thanks for active participation and suggestions. I owe you the points for your time.

(Pretending!)

Thanks,

Re: Re: Re: * Another Section Access Question *

Luis_Cortizo — Mon, 10 Feb 2014 18:36:03 GMT

Yes, for me that would be the conclussion. The Section Access is only effective when opening the document. Whenever anyone is allowed to reload it reads all the information as Michael wisely pointed out.

The most effective way of prohibit to extract information out of a QlikView document is deny the possibility to perform a binary load of it.

Best regards.

Re: Re: Re: * Another Section Access Question *

Anonymous — Mon, 10 Feb 2014 18:36:32 GMT

So it's really important to have check the "Prohibit Binary Load" setting on sensitive applications.

Exactly

topic Re: Re: Re: *** Another Section Access Question *** in QlikView

*** Another Section Access Question ***

Re: *** Another Section Access Question ***

Re: *** Another Section Access Question ***

Re: Re: *** Another Section Access Question ***

Re: *** Another Section Access Question ***

Re: Re: *** Another Section Access Question ***

Re: *** Another Section Access Question ***

Re: Re: Re: *** Another Section Access Question ***

Re: Re: *** Another Section Access Question ***

Re: Re: Re: *** Another Section Access Question ***

Re: Re: Re: *** Another Section Access Question ***

Re: Re: Re: *** Another Section Access Question ***

Re: Re: Re: Re: *** Another Section Access Question ***

Re: Re: Re: *** Another Section Access Question ***

Re: Re: Re: *** Another Section Access Question ***

topic Re: Re: Re: * Another Section Access Question * in QlikView

* Another Section Access Question *

Re: * Another Section Access Question *

Re: * Another Section Access Question *

Re: Re: * Another Section Access Question *

Re: * Another Section Access Question *

Re: Re: * Another Section Access Question *

Re: * Another Section Access Question *

Re: Re: Re: * Another Section Access Question *

Re: Re: * Another Section Access Question *

Re: Re: Re: * Another Section Access Question *

Re: Re: Re: * Another Section Access Question *

Re: Re: Re: * Another Section Access Question *

Re: Re: Re: Re: * Another Section Access Question *

Re: Re: Re: * Another Section Access Question *

Re: Re: Re: * Another Section Access Question *